-1

When I login to Ubuntu via the text console, I can see that a /bin/login process is the parent process of my shell. login is run as follows: /bin/login -p --. This can be seen below:

$ ps -f -C login
UID          PID    PPID  C STIME TTY          TIME CMD
root         780       1  0 Apr27 tty2     00:00:00 /bin/login -p --

My question is, what is the significance of the final -- argument? This argument is not documented in the login manpage.

1
1

Other answers have described what the -- means (end of option processing). Here I will try to answer how and why it arises in the context of the TTY-based /bin/login process.

Specifically, if you take a look at the [Service] section of /lib/systemd/system/getty@.service you should see the following ExecStart line:

ExecStart=-/sbin/agetty -o '-p -- \\u' --noclear %I $TERM

The reason for adding the -- is documented in man agetty:

SECURITY NOTICE
       If  you  use  the --login-program and --login-options options, be aware
       that a malicious user may try to enter lognames with embedded  options,
       which then get passed to the used login program.  Agetty does check for
       a leading "-" and makes sure the logname gets passed as  one  parameter
       (so embedded spaces will not create yet another parameter), but depend‐
       ing on how the login binary parses the command line that might  not  be
       sufficient.   Check  that  the used login program cannot be abused this
       way.

       Some  programs use "--" to indicate that the rest  of  the  commandline
       should not be interpreted as options.  Use this feature if available by
       passing "--" before the username gets passed by \u.
1
  • So getty (or agetty?) runs the following: /bin/login -p -- $USER? And then /bin/login removes/hides the $USER, with the result that $USER does not appear in the output of ps -f -C login?
    – mpb
    Apr 29 '20 at 2:24
0

Since I cannot mark this as a duplicate of a non AksUbuntu stack exchange site... I have shamelessly copied this answer over.

In man bash we can read in Shell Builtin Commands section:

Unless otherwise noted, each builtin command documented in this section as accepting options preceded by - accepts -- to signify the end of the options.

The :, true, false, and test builtins do not accept options and do not treat -- specially. The exit, logout, break, continue, let, and shift builtins accept and process arguments beginning with - without requiring --. Other builtins that accept arguments but are not specified as accepting options interpret arguments beginning with - as invalid options and require -- to prevent this interpretation.

Note that echo does not interpret -- to mean the end of options.

Also

More precisely, a double dash (--) is used in most bash built-in commands and many other commands to signify the end of command options, after which only positional parameters are accepted.

Example use: lets say you want to grep a file for the string -v - normally -v will be considered the option to reverse the matching meaning (only show lines that do not match), but with -- you can grep for string -v like this:

grep -- -v file

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.